PpmEventIdleDurationExpiration
void __fastcall PpmEventIdleDurationExpiration(unsigned __int16 *a1, __int64 a2, EVENT_DESCRIPTOR *a3){
unsigned __int16 v4;
unsigned __int16 v5;
unsigned __int16 v6;
__int64 v7;
__int64 v8;
unsigned int v9;
__int64 *v10;
__int64 v11;
__int64 v12;
__int64 v13;
UINT64 UserDataCount;
unsigned __int16 v15;
EVENT_DATA_DESCRIPTOR UserData[41];
__int64 v17[40];
if( PpmEtwRegistered && EtwEventEnabled(PpmEtwHandle, (EVENT_DESCRIPTOR *)&PPM_ETW_IDLE_DURATION_EXPIRATION, a3) )
{
v4 = *a1;
v5 = 0;
v6 = 0;
v15 = 0;
do
{
v7 = 2i64 * v5;
*(_OWORD *)&v17[v7] = 0i64;
LOWORD(v17[v7 + 1]) = v6;
if( v6 >= v4 )
v8 = 0i64;
else
v8 = *(_QWORD *)&a1[4 * v6 + 4];
v17[2 * v5] = v8;
if( v8 )
++v5;
++v6;
}
while( v6 < 0x14u );
v15 = v5;
UserData[0].Ptr = (unsigned __int64)&v15;
*(_QWORD *)&UserData[0].Size = 2i64;
v9 = 1;
if( v5 )
{
v10 = v17;
v11 = v5;
do
{
v12 = v9;
UserData[v12].Ptr = (unsigned __int64)(v10 + 1);
*(_QWORD *)&UserData[v12].Size = 2i64;
v13 = v9 + 1;
v9 += 2;
UserData[v13].Ptr = (unsigned __int64)v10;
v10 += 2;
*(_QWORD *)&UserData[v13].Size = 8i64;
--v11;
}
while( v11 );
}
LODWORD(UserDataCount) = v9;
EtwWriteEx(
PpmEtwHandle,
(EVENT_DESCRIPTOR *)&PPM_ETW_IDLE_DURATION_EXPIRATION,
0i64,
0i64,
0i64,
0i64,
UserDataCount,
UserData);
}
}Referenced by:
PoExecuteIdleCheck